1. Introduction

Nemak, S.A.B. de C.V., headquartered at Libramiento Arco Vial Km. 3.8, García, Nuevo León 66017, Mexico, together with its subsidiaries and affiliated companies worldwide (collectively, “Nemak”, “we”, “our”, or “us”) are committed to protecting the privacy and security of personal data.

This Global Candidate Privacy Notice (“Notice”) explains how Nemak collects, uses, stores, shares, transfers, and otherwise processes personal data relating to individuals who apply for employment opportunities with Nemak or participate in recruitment and hiring activities.

This Notice applies globally to candidates applying for employment opportunities with Nemak, except where a local privacy notice or country-specific supplement is required under applicable law.

2. Who Is Responsible for Your Personal Data

The Nemak company managing the position for which you apply and/or acting as your prospective employer will generally be the entity responsible for processing your personal data (“Data Controller” or equivalent concept under applicable law).

The identity and contact details of the applicable Data Controller will be made available through the relevant job posting, recruiting platform, employment application, or during the recruitment process.

For administrative, human resources, talent management, compliance, and operational purposes, your personal data may be shared among Nemak group companies in accordance with applicable laws and this Notice.

3. Scope of This Notice

This Notice applies to:

• Job applicants
• Employment candidates
• Individuals participating in recruitment and selection processes
• Individuals considered for internships, apprenticeships, trainee programs, or similar opportunities
• Individuals included in talent pools or candidate databases maintained by Nemak.

This Notice applies regardless of how your information is submitted, including through:

• Nemak websites
• Career portals
• Online application systems
• Recruitment agencies
• Employee referrals
• Professional networking platforms
• Job fairs and recruiting events
• Email communications
• Any other lawful recruitment channel

4. Personal Data We Collect

Depending on the position, local legal requirements, and the stage of the recruitment process, Nemak may collect the following categories of personal data:

(i) Identification and Contact Information

• Name
• Address
• Telephone number
• Email address
• Date and place of birth
• Nationality
• Government-issued identification data
• Passport information
• Work authorization information
• Tax identification information
• Social security or national insurance identifiers where required by law

(ii) Professional and Educational Information

• Resume or curriculum vitae
• Academic qualifications
• Degrees and certifications
• Professional licenses
• Educational history
• Professional experience
• Skills and competencies
• Language proficiency
• References and recommendations
• Training records

(iii) Recruitment and Assessment Information

• Application forms
• Interview notes
• Candidate evaluations
• Assessment and testing results
• Work samples
• Compensation expectations
• Availability information
• Relocation preferences
• Travel availability

(iv) Publicly Available Professional Information

Where permitted by applicable law, Nemak may review professional information publicly available through sources such as LinkedIn or other professional networking platforms.

Failure to provide certain personal data may prevent Nemak from evaluating your application, administering the recruitment process, considering you for employment opportunities, or complying with applicable legal obligations.

5. Special Categories of Personal Data

Nemak does not generally seek to collect special categories of personal data. Candidates are requested not to provide special categories of personal data unless such information is specifically requested by Nemak or required for the recruitment process under applicable law. Where permitted or required by applicable law and where necessary for a specific position, Nemak may process:

• Health-related information
• Disability accommodation information
• Information necessary to comply with employment, social security, or labor law obligations
• Criminal record information where legally permitted
• Other sensitive or special category data as permitted by applicable law

Where required by law, Nemak will obtain the necessary consent or rely on another lawful basis before processing such data.

6. Sources of Personal Data

Nemak may collect personal data directly from you or from other lawful sources, including:

• Recruitment agencies
• Headhunters
• Employee referrals
• Former employers and references that you authorize us to contact
• Educational institutions, where permitted by law
• Background screening providers
• Publicly available professional sources
• Government authorities where legally authorized

Where personal data is not obtained directly from you, Nemak will provide any information required by applicable law regarding the source and processing of such information.

7. Purposes of Processing

Nemak may process personal data for the following purposes:

Recruitment and Selection

• Reviewing applications
• Evaluating qualifications and suitability
• Conducting interviews
• Assessing skills, competencies, and experience
• Managing recruitment processes
• Communicating with candidates

Verification Activities

• Verifying information provided during the recruitment process
• Conducting reference checks
• Conducting background checks where legally permitted

Employment Preparation

• Preparing employment offers
• Facilitating onboarding activities
• Performing pre-employment administrative processes

Legal and Compliance Purposes

• Complying with legal obligations
• Meeting immigration and work authorization requirements
• Addressing lawful requests from public authorities
• Protecting Nemak’s legal rights

Future Opportunities

With your consent where required by applicable law, Nemak may retain your information to:

• Consider you for future employment opportunities
• Maintain talent pools
• Contact you regarding future vacancies

Where consent is relied upon as the legal basis for processing, candidates may withdraw their consent at any time.

8. Legal Bases for Processing

Depending on the applicable jurisdiction, Nemak may process personal data based on one or more of the following legal grounds:

• Taking steps prior to entering into an employment contract
• Compliance with legal obligations
• Nemak’s legitimate business interests
• Your consent where required by law
• Other legal grounds recognized under applicable data protection laws

Nemak’s legitimate interests may include workforce planning, talent management, candidate evaluation, fraud prevention, protection of company assets, information security, and the establishment, exercise, or defense of legal claims.

9. Background Checks

Where permitted by applicable law and relevant to the position, Nemak may conduct background screening activities, including verification of:

• Employment history
• Education credentials
• Professional qualifications
• References
• Work authorization status
• Criminal records where legally authorized

Background checks will be performed only in accordance with applicable laws and local requirements.

10. Sharing and Disclosure of Personal Data

Nemak may disclose personal data to:

• Nemak group companies;
• Recruitment service providers;
• Assessment providers;
• Background screening providers;
• Information technology providers;
• Cloud service providers;
• Professional advisers, including legal, tax, and auditing advisers;
• Government authorities and regulators where required by law; and
• Other third parties where legally permitted.

Nemak does not sell candidates’ personal data.

11. International Transfers

As a global organization, Nemak may transfer personal data between its group companies and service providers located in different countries.

Where required by applicable law, Nemak will implement appropriate safeguards for international transfers, including:

• Standard Contractual Clauses approved by approved by the European Commission
• Adequacy decisions issued by competent authorities
• Intra-group agreements
• Other legally recognized transfer mechanisms

Candidates may request additional information regarding the safeguards implemented for international data transfers where permitted by applicable law.

12. Data Retention

Nemak retains personal data only for as long as necessary to fulfill the purposes described in this Notice, comply with legal obligations, resolve disputes, and enforce agreements. Unless otherwise required by applicable law:

• Information relating to unsuccessful candidates may be retained for up to twenty-four (24) months following completion of the recruitment process. Where candidates create and maintain a profile or account within Nemak’s recruitment platform, such information may remain available for future employment opportunities and will be deleted following the applicable period of inactivity or in accordance with local legal requirements.
• Information relating to successful candidates may become part of their employment records and be retained in accordance with applicable employment record retention requirements.

Candidates may request deletion of their data where permitted by law. Where consent serves as the basis for retaining candidate information for future opportunities, such consent may be withdrawn at any time.

13. Data Security

Nemak maintains reasonable administrative, technical, physical, and organizational safeguards designed to protect personal data against unauthorized access, use, disclosure, alteration, loss, or destruction.

Access to candidate information is limited to personnel and service providers with a legitimate business need to know.

14. Your Rights

Subject to applicable law, candidates may have the right to:

• Access personal data;
• Correct inaccurate data;
• Request deletion or erasure;
• Object to certain processing activities;
• Restrict processing;
• Request portability of personal data;
• Withdraw consent where consent is the legal basis for processing;
• Request information regarding international data transfers;
• Exercise any additional rights available under applicable law; and
• Not be subject to a decision based solely on automated processing, including profiling, where prohibited by applicable law

For candidates located in Mexico, these rights include the rights of Access, Rectification, Cancellation, and Opposition (ARCO Rights) in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares).

For candidates located in certain jurisdictions, including the European Economic Area (EEA), the United Kingdom, Switzerland, Brazil, China, the United States, India, Türkiye, Argentina, and other countries with applicable privacy or data protection laws, additional rights and protections may apply. Such rights may arise under, among others, the EU General Data Protection Regulation (GDPR), the UK GDPR & Data Protection Act 2018, Swiss Data Protection Law (DSG), Brazil’s General Data Protection Law (LPGD), Personal Information Protection Law of the People’s Republic of China (PIPL), applicable U.S. state privacy laws, India’s Digital Personal Data Protection Act (DPDPA), Türkiye’s Law on the Protection of Personal Data (KVKK), Argentina’s Personal Data Protection Law (PDPA), and other applicable privacy and data protection laws. Where required by applicable law, Nemak may provide additional disclosures or country-specific privacy supplements describing rights, obligations, and protections applicable in a particular jurisdiction.

15. Complaints

Where permitted under applicable law, candidates may lodge a complaint with the competent data protection or privacy authority, including the supervisory authority in the country where they reside, work, or where an alleged infringement of applicable privacy laws has occurred.

16. Automated Decision-Making

Nemak does not make hiring decisions based solely on automated processing, including profiling, which produces legal or similarly significant effects on candidates.

All recruitment decisions involve meaningful human review.

17. Country-Specific Privacy Supplements

Depending on your location and the Nemak entity administering the recruitment process, additional privacy rights, disclosures, and requirements may apply under local laws.

To the extent applicable, all country- or region-specific privacy supplements form part of this Notice. Please review the applicable supplement, if any, based on your country of residence, the location of the position for which you apply, or as otherwise required by applicable law.

In the event of a conflict between this Notice and an applicable country-specific supplement, the relevant supplement shall prevail to the extent required by applicable law.

18. Contact Us

Questions regarding this Notice or requests concerning personal data may be directed to:

Global Data Privacy Office

Email: dataprivacy@nemak.com

Where a Data Protection Officer (DPO) has been appointed pursuant to applicable law, candidates may contact the DPO through the contact details communicated by the relevant Nemak entity.

Governance & Compliance Department

Email: governance@nemak.com

Candidates may also contact the relevant Human Resources manager of the Nemak entity responsible for the specific recruitment process.

19. Changes to This Notice

Nemak may update this Notice from time to time to reflect changes in legal requirements, business operations, or privacy practices.

The most current version will be available on Nemak’s website and will become effective upon publication.

Last updated: July 29, 2026